The compromise of Anthropic’s official Claude Code extension on Cursor’s extension market was the results of the theft of an entry key that was uncovered within the wake of a breach concentrating on Fireworks AI.
“An attacker obtained an entry key we had issued to Fireworks,” Cursor mentioned in a Friday replace. “The important thing was uncovered by Fireworks, and the attacker used it to repeat knowledge from a read-only storage bucket we used to share knowledge with them.”
The disclosure comes practically two weeks after a trojanized model of Anthropic’s official Claude Code extension was distributed by Cursor Market as a authentic replace, making an attempt to put in a persistent SSH backdoor on affected methods.
In keeping with the synthetic intelligence (AI)-powered coding platform, the read-only storage bucket is alleged to have contained restricted coding agent traces from classes that weren’t in Privateness Mode. Privateness Mode is a Cursor-specific setting that, if enabled, permits customers to choose out of their knowledge getting used for coaching functions.
These classes, most of which date again to 2025, had been permitted for use for mannequin coaching. Amongst these traces had been credentials that had not been edited out, exposing the API credentials of lower than 0.01% of shoppers within the course of.
The attacker, Cursor added, used these credentials as a place to begin to achieve choose software-as-a-service (SaaS) instruments utilized by Cursor after which entry the next knowledge –
- Choose archived non-production Cursor supply code repositories, together with some containing enterprise contact info
- Restricted buyer help knowledge and e-mail conversations
- Product utilization metrics and call particulars
- Summaries of some coding agent conversations
- Some credentials customers had despatched to the Cursor help group
Cursor mentioned it took steps to deactivate the seller’s key, revoke and rotate credentials, and hunt for indicators of deeper entry, and include it after “we recognized additional entry.” The corporate additionally mentioned it quickly disabled inside and product providers, disrupting entry to some Cursor options.
The subsequent part of the assault occurred on October 29, 2026, when the attacker used a stolen credential from the uncovered knowledge of its inside system to put trojanized variations of Anthropic’s Claude Code extension immediately on the cache used to serve Cursor’s extension market.
“At most 5,000 customers who requested particular cached variations of the extension on October 29 doubtlessly obtained the malicious construct,” Cursor mentioned. “It was accessible for about 11 hours earlier than we eliminated it. We took it down, took the extension market offline, and labored with the cloud service supplier internet hosting the attacker’s server to take it down.”
The corporate mentioned it notified affected customers who put in variations 2.1.312 or 2.1.313 from {the marketplace} in the course of the publicity window and helped revoke uncovered credentials. It has additionally moved all inference visitors off Fireworks, deactivated the important thing issued to it, and minimize off its entry to all knowledge units we shared with it.
Moreover, Cursor emphasised that no further malicious exercise has been detected since November 1, 2026.
There is no such thing as a proof that the incident impacted customers who had enabled Privateness Mode, buyer code repositories, Cursor’s personal manufacturing surroundings, Cursor app and its official updates, its different apps, or every other extension or plugin downloaded from Cursor Market.
Uber Additionally Impacted by Fireworks Incident
The event comes as Uber confirmed unknown menace actors stole 1000’s of drivers’ license info after acquiring inside credentials.
“On October 9, 2026, a service supplier notified Uber that an unauthorized third-party had compromised the service supplier’s inside credentials and used them to entry Uber’s account with the service supplier,” the corporate mentioned in a submitting with the U.S. state of California. “On October 13, 2026, our investigation decided that the unauthorized get together had used the compromised credentials to entry Uber knowledge linked to the service supplier.”
Though the title of the supplier was not disclosed, TechCrunch reported that the supplier in query is Fireworks AI. Uber has not disclosed what number of customers had been impacted by the breach. Final week, on-line productiveness startup Notion additionally confirmed its knowledge was stolen within the Fireworks AI hack.
